From: Anton Khirnov <anton@khirnov.net>
To: notmuch@notmuchmail.org
Subject: [PATCH] doc/examples: add a Firejail profile for sandboxing filtering programs
Date: Sat, 15 Aug 2026 19:48:57 +0200
Message-ID: <20260815174919.27774-1-anton@khirnov.net>
In-Reply-To: <20260815140127.26199-6-anton@khirnov.net>
References: <20260815140127.26199-6-anton@khirnov.net>
MIME-Version: 1.0
Message-ID-Hash: YUW2PYMIHZ4J7TW3OUT5VPO2D2TFOEZA
Precedence: list
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

---
Now actually including the profile
---
 Makefile.local                |  2 +-
 configure                     |  6 +++++
 debian/rules                  |  1 +
 doc/Makefile.local            |  8 ++++++-
 doc/examples/firejail.profile | 41 +++++++++++++++++++++++++++++++++++
 doc/man1/notmuch-config.rst   |  8 +++++++
 6 files changed, 64 insertions(+), 2 deletions(-)
 create mode 100644 doc/examples/firejail.profile

diff --git a/Makefile.local b/Makefile.local
index 828e58ef..259872b5 100644
--- a/Makefile.local
+++ b/Makefile.local
@@ -280,7 +280,7 @@ git-remote-notmuch-shared: git-remote-notmuch.o status.o tag-util.o query-string
 	$(call quiet,$(FINAL_NOTMUCH_LINKER) $(CFLAGS)) $^ $(FINAL_NOTMUCH_LDFLAGS) -o $@
 
 .PHONY: install
-install: all install-man install-info
+install: all install-man install-info install-examples
 	mkdir -p "$(DESTDIR)$(prefix)/bin/"
 	install notmuch-shared "$(DESTDIR)$(prefix)/bin/notmuch"
 	install git-remote-notmuch-shared "$(DESTDIR)$(prefix)/bin/git-remote-notmuch"
diff --git a/configure b/configure
index b5634fba..72945332 100755
--- a/configure
+++ b/configure
@@ -178,6 +178,7 @@ Fine tuning of some installation directories is available:
 	--includedir=DIR	Install header files to DIR [PREFIX/include]
 	--mandir=DIR		Install man pages to DIR [PREFIX/share/man]
 	--infodir=DIR		Install man pages to DIR [PREFIX/share/man]
+	--docdir=DIR		Install additional documentation to DIR [PREFIX/share/doc/notmuch]
 	--sysconfdir=DIR	Read-only single-machine data [PREFIX/etc]
 	--emacslispdir=DIR	Emacs code [PREFIX/share/emacs/site-lisp]
 	--emacsetcdir=DIR	Emacs miscellaneous files [PREFIX/share/emacs/site-lisp]
@@ -225,6 +226,8 @@ for option; do
 	MANDIR="${option#*=}"
     elif [ "${option%%=*}" = '--infodir' ] ; then
 	INFODIR="${option#*=}"
+    elif [ "${option%%=*}" = '--docdir' ] ; then
+	DOCDIR="${option#*=}"
     elif [ "${option%%=*}" = '--sysconfdir' ] ; then
 	SYSCONFDIR="${option#*=}"
     elif [ "${option%%=*}" = '--emacslispdir' ] ; then
@@ -1402,6 +1405,9 @@ mandir = ${MANDIR:=\$(prefix)/share/man}
 # The directory to which man pages should be installed
 infodir = ${INFODIR:=\$(prefix)/share/info}
 
+# The directory to which additional documentation should be installed
+docdir = ${DOCDIR:=\$(prefix)/share/doc/notmuch}
+
 # The directory to which read-only (configuration) files should be installed
 sysconfdir = ${SYSCONFDIR:=\$(prefix)/etc}
 
diff --git a/debian/rules b/debian/rules
index 4e0836e7..39234908 100755
--- a/debian/rules
+++ b/debian/rules
@@ -14,6 +14,7 @@ override_dh_auto_configure:
 		--includedir=/usr/include \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
+		--docdir=/usr/share/doc/notmuch \
 		--sysconfdir=/etc \
 		--zshcompletiondir=/usr/share/zsh/vendor-completions \
 		--localstatedir=/var
diff --git a/doc/Makefile.local b/doc/Makefile.local
index aafa77a0..4edc4b1c 100644
--- a/doc/Makefile.local
+++ b/doc/Makefile.local
@@ -38,9 +38,11 @@ endif
 COPY_INFO1 := $(patsubst $(DOCBUILDDIR)/man/man1/%.1,$(DOCBUILDDIR)/texinfo/%.info,$(COPY_ROFF1))
 INFO_INFO_FILES := $(INFO_TEXI_FILES:.texi=.info) $(COPY_INFO1)
 
+EXAMPLES_FILES := doc/examples/firejail.profile
+
 .PHONY: sphinx-html sphinx-texinfo sphinx-info
 
-.PHONY: install-man build-man apidocs install-apidocs
+.PHONY: install-man build-man apidocs install-apidocs install-examples
 
 %.gz: %
 	rm -f $@ && gzip --no-name --stdout $^ > $@
@@ -156,6 +158,10 @@ $(dir)/config.dox: version.stamp
 	echo "PROJECT_NAME = \"Notmuch $(VERSION)\"" > $@
 	echo "INPUT=${srcdir}/lib/notmuch.h" >> $@
 
+install-examples:
+	mkdir -m0755 -p "$(DESTDIR)$(docdir)/examples"
+	install -m0644 $(EXAMPLES_FILES) $(DESTDIR)$(docdir)/examples
+
 CLEAN := $(CLEAN) $(DOCBUILDDIR) $(DOCBUILDDIR)/.roff.stamp $(DOCBUILDDIR)/.texi.stamp
 CLEAN := $(CLEAN) $(DOCBUILDDIR)/.html.stamp $(DOCBUILDDIR)/.info.stamp
 CLEAN := $(CLEAN) $(MAN_GZIP_FILES) $(MAN_ROFF_FILES) $(dir)/conf.pyc $(dir)/config.dox
diff --git a/doc/examples/firejail.profile b/doc/examples/firejail.profile
new file mode 100644
index 00000000..964bb3dc
--- /dev/null
+++ b/doc/examples/firejail.profile
@@ -0,0 +1,41 @@
+# Firejail profile for notmuch attachment filter
+
+quiet
+
+# Persistent global definitions
+include globals.local
+
+include disable-common.inc
+
+apparmor
+caps.drop all
+machine-id
+net none
+no3d
+nodvd
+nogroups
+noinput
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix
+seccomp
+seccomp.block-secondary
+tracelog
+x11 none
+
+disable-mnt
+private-cache
+private-dev
+private-etc gconf
+private-tmp
+
+dbus-user none
+dbus-system none
+
+restrict-namespaces
+
+read-only ${HOME}
diff --git a/doc/man1/notmuch-config.rst b/doc/man1/notmuch-config.rst
index b8c13462..6c972d27 100644
--- a/doc/man1/notmuch-config.rst
+++ b/doc/man1/notmuch-config.rst
@@ -166,6 +166,14 @@ paths are presumed relative to `$HOME` for items in section
    sandboxing mechanism, so that it cannot be subverted to attack your
    system or steal your data.
 
+   Some of the options you may consider are:
+
+   * Firejail (https://firejail.wordpress.com/ , Linux-specific); a sample
+     Firejail profile is shipped with notmuch documentation (typically installed
+     in ``/usr/share/doc/notmuch``) as ``examples/firejail.profile``. You
+     may use it as ``notmuch config set index.filter 'firejail
+     --profile=<.../examples/firejail.profile> <your filter program>'``.
+
    The filter is a commandline split in a POSIX shell-like manner (without
    actually invoking the shell, so shell expansions are not performed and shell
    constructs are not allowed) and executed. The payload of the MIME part to be
-- 
2.47.3

_______________________________________________
notmuch mailing list -- notmuch@notmuchmail.org
To unsubscribe send an email to notmuch-leave@notmuchmail.org